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DETAILED ACTION 



1. 



The amendment of 29 January 2008 has been noted and made of record. 



2. 



Claims 1-4 and 6-8 have been presented for examination. 



Response to Arguments 



3. Applicant's arguments, see page 3, filed 29 January 2008, with respect to the objection to 
the specification have been fully considered and are persuasive. The objection of the 
specification has been withdrawn. 

4. Applicant's arguments with respect to the prior art rejections filed 29 January 2008 have 
been fully considered but they are not persuasive. 

5. The Applicant argues that the prior art does not teach that an e-mail gateway, responding 
to a received notification of a new virus break out, suspends delivery of e-mails and their 
attachments and than resuming normal delivery upon notice of the e-mails have been scanned 
with any updated virus signatures. As noted in the previous Office Action, and again below, 
Tarbotton teaches a method for scanning an received e-mail and upon detecting unwanted 
properties in the e-mail buffering it until such a time that the virus signatures are updated so it 
can be rescanned and, if it is found to be virus-free delivering the e-mail to the intended 
recipient. The Examiner has held that Tarbotton does not teach performing the quarantining of 
received e-mails upon the e-mail gateway receiving notice of a virus outbreak. The Examiner 
relied on Shipp to teach e-mail gateways sharing information regarding new virus outbreaks. 
The Examiner holds that it would have been obvious to one of ordinary skill to combine the 
gateway notification of Shipp with the quarantining of Tarbotton to arrive at the invention of the 
instant application since Shipp states at paragraphs 0096 that alerting e-mail gateways of new 
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viruses allows them to intercept the viruses, recognize the symptoms, and stop further 
occurrences before the virus becomes too widespread. The applicants appear to argue against the 
references individually. One cannot show nonobviousness by attacking references individually 
where the rejections are based on combinations of references. See In re Keller, 642 F.2d 413, 
208 USPQ 871 (CCPA 1981); In reMerck& Co., 800 F.2d 1091, 231 USPQ 375 (Fed. Cir. 
1986). Since the applicant has argued against the references separately and the Examiner has 
shown the combination of references teaches the invention of the instant application the rejection 
of at least claims 1-4 is maintained. 

6. See further rejections set forth below. 

Claim Rejections - 35 USC §103 

7. The text of those sections of Title 35, U.S. Code not included in this action can be found 
in a prior Office action. 

8. Claims 1-4 and 6-8 are rejected under 35 U.S. C. 103(a) as being unpatentable over U.S. 
Patent No. 6,757,830 Bl to Tarbotton et al., hereinafter Tarbotton, in view of U.S. Patent 
Application Publication 2004/0054498 Al to Shipp, hereinafter Shipp. 

9. As per claim 1, Tarbotton teaches a method of preventing the infection of a computer 
network by a computer virus, where that virus can be spread by e-mail traffic, the method 
comprising: 

installing at an e-mail gateway of the network an anti-virus application, which application 
scans at least incoming e-mail traffic for known viruses (Figures 1 [blocks 8, 10, 12], 2, 3 
[blocks 26, 42], column 5, lines 37-41, column 5, line 59 to column 6, line 3, i.e. mail server 
includes anti-virus and anti-spam system that detects unwanted properties in e-mails); 
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a provider of the anti-virus application, sending updates to the anti-virus application 
(Figure 1 [block 14], column 5, line 58 to column 6, line 3); and 

at the anti-virus application, responding to said notification by failing to deliver incoming 
e-mails or their attachments to their recipients within the network (Figure 3 [blocks 32, 34, 36], 
column 6, lines 59-67, column 7, line 21-14, i.e. applying a delay based on e-mail attributes) and 
causing these e-mails or attachments to be re-directed to a buffer for safe storage (Figure 2 
[block 16], column 6, lines 4-14, i.e. dirty mail store); 

subsequently generating a signature for the virus at the anti-virus application provider and 
providing that signature to the application at the gateway (column 1, lines 37-54, column 5, lines 
41-47, i.e. anti-virus provider create and distribute countermeasures) 

at the gateway, after receiving the signature, using the application to scan the previously 
buffered e-mails or attachments for the virus (column 7, lines 7-13); 

after scanning the previously buffered e-mails, delivering e-mails or attachments which 
are virus free to their recipients (column 6, lines 42-55, i.e. delivering disinfected e-mails). 

10. Tarbotton does not teach when a new virus is detected by the provider of the anti-virus 
application, sending a notification of this event from the provider to the anti-virus-application, 
discontinuing the normal handling of e-mails and resuming the normal handling after appropriate 
actions have been taken. 

11. It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to discontinue the normal handling of e-mails when notified of a new virus and 
subsequently resuming the normal handling of e-mails when appropriate countermeasures have 
been taken, since one of ordinary skill in the art would realize that discontinuing the normal 
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handling of e-mails would minimize the damage incurred by a new virus since Tarbotton 
discloses at column 1, lines 37-54 that the speed with which e-mail is distributed an unchecked 
hour can result in dire consequences for the computer systems. Therefore, by discontinuing e- 
mail service temporarily, a skilled artisan would prevent damage to the computer network. 

12. Shipp teaches an e-mail server alerting other e-mail servers of new or previously 
unknown viruses (paragraph 0138). 

13. It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to send notification of a new virus from the anti-virus provider to the anti-virus 
application, since Shipp states at paragraphs 0096 that alerting e-mail gateways of new viruses 
allows them to intercept the viruses, recognize the symptoms, and stop further occurrences 
before the virus becomes too widespread. 

14. Regarding claim 2, Tarbotton teaches establishing a communication channel between the 
anti-virus application provider and the anti-virus over the internet (Figure 1 [block 6]). The 
Applicant admits that TCP/IP and UDP/IP are the most common protocols used on the Internet. 

15. Regarding claim 3, Shipp teaches the application provider sending updates to the 
administrator of the application (paragraph 0138, i.e. alert human operators). The Applicant 
admits that it would have been obvious to one of ordinary skill in the art at the time the invention 
was made to send those updates via email. 
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16. Regarding claim 4, Tarbotton teaches wherein said notification is sent from the 
application provider to the application as a result of a result of a request or enquiry sent from the 
application to the provider (Figure 3 [block 38], column 7, lines 1-13). 

17. As per claims 6 and 7, Tarbotton teaches an anti-virus application for installation on a 
network server on which is also installed an e-mail gateway, the application being arranged to 
interact with the e-mail gateway to scan incoming e-mails and/or e-mail attachments for known 
viruses, the application having 

means the application to prevent delivery of e-mails or c-mail attachments received at the 
gateway and to divert these e-mails or attachments to a buffer for safe storage (Figures 2 [block 
16], 3 [blocks 32, 34, 36], column 6, lines 4-14, column 6, lines 59-67, column 7, line 21-14, i.e. 
applying a delay based on e-mail attributes and storing the emails in the dirty mail store), and 

means the application to cease preventing delivery of newly received e-mails or 
attachments (Figure 3 [blocks 38, 40], column 7, lines 1-13). 

18. Tarbotton does not teach means for receiving a notification from the provider of the 
application regarding a new virus, and means for subsequently receiving a second notification 
from the provider signaling that the messages should be delivered. 

19. Shipp teaches an e-mail server alerting other e-mail servers of new or previously 
unknown viruses (paragraph 0138). 

20. It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to send notification of a new virus from the anti-virus provider to the anti-virus 
application, since Shipp states at paragraphs 0096 that alerting e-mail gateways of new viruses 
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allows them to intercept the viruses, recognize the symptoms, and stop further occurrences 
before the virus becomes too widespread. 

21 . As per claim 8, Tarbotton teaches a method of preventing the infection of a computer 
network by a computer virus, where that virus can be spread by e-mail traffic, the method 
comprising: 

installing at an e-mail gateway of the network an anti-virus application, which application 
scans at least incoming e-mail traffic for known viruses using a database of virus signatures 
(Figures 1 [blocks 8, 10, 12], 2, 3 [blocks 26, 42], column 5, lines 37-41, column 5, line 59 to 
column 6, line 3, i.e. mail server includes anti-virus and anti-spam system that detects unwanted 
properties in e-mails); 

a provider of the anti- virus application, calculating a checksum for the file carrying the 
virus or a relevant part of that file (column 9, lines 10-23), and sending a notification containing 
the checksum from the provider to the anti- virus-application (Figure 1 [block 14], column 5, line 
58 to column 6, line 3); and 

at the anti- virus application, using the checksum to screen e-mails and/or their 
attachments for the virus until such time as a signature for the virus is received by the e-mail 
gateway from the application provider (Figure 3 [blocks 26, 42], column 5, lines 37-41, column 
5, line 59 to column 6, line 3, column 9, lines 10-23). 

22. Tarbotton does not teach when a new virus is detected by the provider of the anti-virus 
application, sending a notification of this event and a checksum from the provider to the anti- 
virus-application. 
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23. Shipp teaches an e-mail server alerting other e-mail servers of new or previously 
unknown viruses (paragraph 0138). 

24. It would have been obvious to one of ordinary skill in the art at the time the invention 
was made to send notification of a new virus from the anti-virus provider to the anti-virus 
application, since Shipp states at paragraphs 0096 that alerting e-mail gateways of new viruses 
allows them to intercept the viruses, recognize the symptoms, and stop further occurrences 
before the virus becomes too widespread. 

Conclusion 

25 . THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1.136(a). 

26. A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of this final action and the advisory action is not mailed until after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 

CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, 
however, will the statutory period for reply expire later than SIX MONTHS from the mailing 
date of this final action. 

27. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Christian LaForgia whose telephone number is (571)272-3792. 
The examiner can normally be reached on Monday thru Thursday 7-5. 
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28. If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kristine L. Kincaid can be reached on (571) 272-4063. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 

29. Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

/Christian LaForgia/ 

Primary Examiner, Art Unit 2139 
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